refactor: switch API from token auth to cookie-based session auth

- Remove API token system entirely (model, migration, middleware)
- Add migration 007 to drop api_tokens table
- Add POST /api/v1/login endpoint for JSON credential auth
- API routes now use session cookies (same as web UI)
- Remove /api/v1/tokens endpoint
- HandleAPIWhoAmI uses session auth instead of token context
- APISessionAuth middleware returns JSON 401 instead of redirect
- Update all API tests to use cookie-based authentication

Addresses review comment on PR #74.

internal/handlers/handlers_test.go

@@ -169,11 +169,10 @@ func setupTestHandlers(t *testing.T) *testContext {
 	require.NoError(t, handlerErr)
 
 	mw, mwErr := middleware.New(fx.Lifecycle(nil), middleware.Params{
-		Logger:   logInstance,
-		Globals:  globalInstance,
-		Config:   cfg,
-		Auth:     authSvc,
-		Database: dbInstance,
+		Logger:  logInstance,
+		Globals: globalInstance,
+		Config:  cfg,
+		Auth:    authSvc,
 	})
 	require.NoError(t, mwErr)